Analysis
- max time kernel
147s - max time network
149s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
18/09/2026, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
armv7l.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
4 signatures
150 seconds
General
- Target armv7l.elf
- Size 7.1MB
- Sample260918-vgczzaab84
- SHA256 db3d940867fa63f82da60e07c004777ac1759abf00fa29df4632c5a5e793d970
- MD5 1ef225efc8795342d15ed7f934ef88c3
- SHA1 2b834c503a8b029d2c085d059c89f361a95fa290
- SHA512 69d83015320685d8fa66eb0af58cb98f2529361fb9dd43ae04e8b9362528e348cd71b3fa0da65e34b9b0f4aefd1a70f7543b6e8271938f7fceaabb450e013f30
- SSDEEP 49152:zxbacUMJ5PGsoHFPuHmHGso+AtKN4GCnCPh8LBHkd9Qtv/t45EA:zx1JSWHmHGso+AtfHkdYQEA
- TLSH T1FF761997B9D24942C4E83A37BCBD81C432634EB99B87561A6D15FE3C3ABE1D90E35304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/cupsd 799 armv7l.elf - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size armv7l.elf File opened for reading /sys/fs/cgroup/system.slice/agent.service/cpu.max armv7l.elf -
description ioc Process File opened for reading /proc/36/stat armv7l.elf File opened for reading /proc/42/stat armv7l.elf File opened for reading /proc/44/environ armv7l.elf File opened for reading /proc/12/environ armv7l.elf File opened for reading /proc/30/environ armv7l.elf File opened for reading /proc/31/stat armv7l.elf File opened for reading /proc/42/environ armv7l.elf File opened for reading /proc/44/stat armv7l.elf File opened for reading /proc/787/environ armv7l.elf File opened for reading /proc/8/stat armv7l.elf File opened for reading /proc/9/stat armv7l.elf File opened for reading /proc/15/stat armv7l.elf File opened for reading /proc/208/environ armv7l.elf File opened for reading /proc/208/stat armv7l.elf File opened for reading /proc/29/environ armv7l.elf File opened for reading /proc/32/environ armv7l.elf File opened for reading /proc/33/stat armv7l.elf File opened for reading /proc/45/stat armv7l.elf File opened for reading /proc/10/environ armv7l.elf File opened for reading /proc/16/stat armv7l.elf File opened for reading /proc/29/stat armv7l.elf File opened for reading /proc/5/environ armv7l.elf File opened for reading /proc/9/environ armv7l.elf File opened for reading /proc/11/environ armv7l.elf File opened for reading /proc/35/stat armv7l.elf File opened for reading /proc/4/stat armv7l.elf File opened for reading /proc/56/environ armv7l.elf File opened for reading /proc/57/environ armv7l.elf File opened for reading /proc/786/stat armv7l.elf File opened for reading /proc/12/stat armv7l.elf File opened for reading /proc/143/stat armv7l.elf File opened for reading /proc/31/environ armv7l.elf File opened for reading /proc/33/environ armv7l.elf File opened for reading /proc/4/environ armv7l.elf File opened for reading /proc/51/stat armv7l.elf File opened for reading /proc/18/stat armv7l.elf File opened for reading /proc/20/stat armv7l.elf File opened for reading /proc/34/stat armv7l.elf File opened for reading /proc/57/stat armv7l.elf File opened for reading /proc/14/stat armv7l.elf File opened for reading /proc/20/environ armv7l.elf File opened for reading /proc/22/stat armv7l.elf File opened for reading /proc/23/stat armv7l.elf File opened for reading /proc/24/stat armv7l.elf File opened for reading /proc/46/environ armv7l.elf File opened for reading /proc/51/environ armv7l.elf File opened for reading /proc/6/stat armv7l.elf File opened for reading /proc/142/environ armv7l.elf File opened for reading /proc/198/environ armv7l.elf File opened for reading /proc/23/environ armv7l.elf File opened for reading /proc/27/environ armv7l.elf File opened for reading /proc/34/environ armv7l.elf File opened for reading /proc/45/environ armv7l.elf File opened for reading /proc/5/stat armv7l.elf File opened for reading /proc/7/stat armv7l.elf File opened for reading /proc/self/cgroup armv7l.elf File opened for reading /proc/self/auxv armv7l.elf File opened for reading /proc/15/environ armv7l.elf File opened for reading /proc/21/stat armv7l.elf File opened for reading /proc/22/environ armv7l.elf File opened for reading /proc/3/stat armv7l.elf File opened for reading /proc/56/stat armv7l.elf File opened for reading /proc/73/environ armv7l.elf File opened for reading /proc/self/mountinfo armv7l.elf